3 ms·
Nope, you can't. You still have to check for uniqueness on the server side before committing them, so you are back from the start. Always keep in mind that any
by dullgiulio 9y ago
Nope, you can't. You still have to check for uniqueness on the server side before committing them, so you are back from the start.
Always keep in mind that anything coming from the client cannot be trusted.
- ProblemFactory 9y agoYou can't blindly overwrite existing data based on the UUID, sure. But I find that the security checks against "stealing UUIDs" are much simpler to implement than a system of composite primary keys (deviceid+autoincrement or userid+autoincrement) or some sort of temporary primary keys. If you see suspicious UUIDs, you can just discard the data. Having the client generate the "final" IDs for objects is particularly convenient when the client can produce a complex graph of objects offline, for example an order + order items + comments + more. If using temporary IDs until first contact with server, all these links would have to be patched up when the objects get real server-side-assigned IDs.